API Reference · Checks

Check Email Auth

Full SPF/DKIM/DMARC/BIMI inspection

POST/v1/checks/email-auth

Public (no credentials needed)MCP:check_email_security

Queries the domain's authoritative nameservers (sees changes within seconds), DNS-over-HTTPS fallback. Findings are plain English with exact fixes.

cURL example

cURL request

curl -X POST "https://api.verifiedinbox.ai/v1/checks/email-auth" \
  -H "Content-Type: application/json" \
  -d '{
    "dkim_selectors": [
      "string"
    ],
    "domain": "acme.com"
  }'

Request body

application/json · required

Field	Type	Description
dkim_selectorsoptional	string[]	Extra DKIM selectors to check (common ones are probed).
domainrequired	string	A domain, URL or email address.

Example request payload (CheckEmailAuthRequest)

{
  "dkim_selectors": [
    "string"
  ],
  "domain": "acme.com"
}

Response

200 OKInspection report.

application/json

Field	Type	Description
bimirequired	object	— Nested fields (5) `authority_url` (string) `findings` (Finding[]) `logo_url` (string) `record` (string) `status` (string)
checked_atrequired	string (date-time)	—
dkimrequired	object	— Nested fields (3) `findings` (Finding[]) `selectors` (object[]) `status` (string)
dmarcrequired	object	— Nested fields (9) `findings` (Finding[]) `inherited_from` (string) `pct` (integer) `policy` (string) `record` (string) `rollout_stage` (string) `rua` (string[]) `status` (string) `subdomain_policy` (string)
domainrequired	string	—
findingsrequired	Finding[]	Every finding, most severe first. Nested fields (7) `area` (string) `detail` (string): Plain English. `fix` (RecordFix) `id` (string) `severity` (string) `technical` (string): Exact technical description. `title` (string): Plain English.
mxrequired	object	— Nested fields (3) `provider` (MailboxProvider) `records` (object[]) `status` (string)
resolverrequired	string	Least-fresh source used; `authoritative` = the domain's own nameservers. Allowed: `authoritative`, `doh`, `system`
scorerequired	object	— Nested fields (3) `passed` (integer) `status` (string) `total` (integer)
spfrequired	object	— Nested fields (5) `all` (string) `findings` (Finding[]) `lookups` (integer) `record` (string) `status` (string)

Example 200 response (EmailAuthReport)

{
  "bimi": {
    "authority_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
    "findings": [],
    "logo_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
    "record": "string",
    "status": "pass"
  },
  "checked_at": "2026-10-31T12:00:00Z",
  "dkim": {
    "findings": [],
    "selectors": [],
    "status": "pass"
  },
  "dmarc": {
    "findings": [],
    "inherited_from": "string",
    "pct": 1,
    "policy": "none",
    "record": "string",
    "rollout_stage": "missing",
    "rua": [],
    "status": "pass",
    "subdomain_policy": "none"
  },
  "domain": "acme.com",
  "findings": [
    {
      "area": "mx",
      "detail": "string",
      "fix": {
        "host": "string",
        "note": "string",
        "type": "string",
        "value": "string"
      },
      "id": "0192a5e0-1234-7000-8000-000000000001",
      "severity": "info",
      "technical": "string",
      "title": "string"
    }
  ],
  "mx": {
    "provider": {
      "id": "0192a5e0-1234-7000-8000-000000000001",
      "name": "Acme Inc."
    },
    "records": [],
    "status": "pass"
  },
  "resolver": "authoritative",
  "score": {
    "passed": 1,
    "status": "ready",
    "total": 1
  },
  "spf": {
    "all": "string",
    "findings": [],
    "lookups": 1,
    "record": "string",
    "status": "pass"
  }
}

Other responses & possible errors

Expand a status code below to see the error code, description, and example error payload.

400 (invalid_request)`invalid_request` — the request is malformed.

`invalid_request` — the request is malformed.

Example 400 error response

{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}

422 (unprocessable)`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

Example 422 error response

{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}

429 (rate_limited)`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

Example 429 error response

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}

Was it helpful?